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ABSTRACT. Nominal Isabelle is a definitional extension of the Isabelle/HOL theorem prover. It 
provides a proving infrastructure for reasoning about programming language calculi involving named 
bound variables (as opposed to de-Bruijn indices). In this paper we present an extension of Nominal 
Isabelle for dealing with general bindings, that means term constructors where multiple variables are 
bound at once. Such general bindings are ubiquitous in programming language research and only 
very poorly supported with single binders, such as lambda-abstractions. Our extension includes new 
definitions of alpha-equivalence and establishes automatically the reasoning infrastructure for alpha- 
equated terms. We also prove strong induction principles that have the usual variable convention 
already built in. 

1. INTRODUCTION 

So far, Nominal Isabelle provided a mechanism for constructing alpha-equated terms, for example 
lambda-terms 

t ::= x | t 1 1 Ax. t 

where free and bound variables have names. For such alpha-equated terms, Nominal Isabelle derives 
automatically a reasoning infrastructure that has been used successfully in formalisations of an 
equivalence checking algorithm for LF [27], Typed Scheme [24], several calculi for concurrency 
j3l and a strong normalisation result for cut-elimination in classical logic QUI . It has also been used 
by Pollack for formalisations in the locally-nameless approach to binding ll20l . 

However, Nominal Isabelle has fared less well in a formalisation of the algorithm W [29], where 
types and type-schemes are, respectively, of the form 

T::=x\T^T S ::= V{xi,. . . , x n }. T (1.1) 
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and the V -quantification binds a finite (possibly empty) set of type- variables. While it is possible to 
implement this kind of more general binders by iterating single binders, like Vxi.Vx2...Vx n .r, this 
leads to a rather clumsy formalisation of W. For example, the usual definition for a type being an 
instance of a type-scheme requires in the iterated version the following auxiliary unbinding relation: 

S ^ (xs, T) 
([],r) Vx.S-^ (x::xs,T) 

Its purpose is to relate a type-scheme with a list of type-variables and a type. It is used to address 
the following problem: Given a type-scheme, say S, how does one get access to the bound type- 
variables and the type-part of S? The unbinding relation gives an answer to this problem, though in 
general it will only provide a list of type-variables together with a type that are "alpha-equivalent" 
to S. This is because unbinding is a relation; it cannot be a function for alpha-equated type-schemes. 
With the unbinding relation in place, we can define when a type T is an instance of a type-scheme S 
as follows: 

T ~< S d = 3xs T' o. S ^ (xs, T 1 ) A dom a = set xs A o~(T') = T 

This means there exists a list of type- variables xs and a type T'to which the type-scheme S unbinds, 
and there exists a substitution a whose domain is xs (seen as set) such that a{T') = T. The problem 
with this definition is that we cannot follow the usual proofs that are by induction on the type-part 
of the type-scheme (since it is under an existential quantifier and only an alpha-variant). The imple- 
mentation of type-schemes using iterations of single binders prevents us from directly "unbinding" 
the bound type-variables and the type-part. Clearly, a more dignified approach for formalising al- 
gorithm W is desirable. The purpose of this paper is to introduce general binders, which allow us 
to represent type-schemes so that they can bind multiple variables at once and as a result solve this 
problem more straightforwardly. The need of iterating single binders is also one reason why the 
existing Nominal Isabelle and similar theorem provers that only provide mechanisms for binding 
single variables have so far not fared very well with the more advanced tasks in the POPLmark 
challenge [2], because also there one would like to bind multiple variables at once. 

Binding multiple variables has interesting properties that cannot be captured easily by iterating 
single binders. For example in the case of type-schemes we do not want to make a distinction about 
the order of the bound variables. Therefore we would like to regard in (11.2b below the first pair of 
type-schemes as alpha-equivalent, but assuming that x, y and z are distinct variables, the second pair 
should not be alpha-equivalent: 

V{x, yj.x^y & a V{x, yj.y^x V {x, y}. x ->• y ^ a V {z}. z -> Z (1.2) 

Moreover, we like to regard type-schemes as alpha-equivalent, if they differ only on vacuous binders, 
such as 

V{x}.x-s>.y w a V{x, zj.x^y (1.3) 

where z does not occur freely in the type. In this paper we will give a general binding mechanism and 
associated notion of alpha-equivalence that can be used to faithfully represent this kind of binding in 
Nominal Isabelle. The difficulty of finding the right notion for alpha-equivalence can be appreciated 
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in this case by considering that the definition given for type-schemes by Leroy in lfT3l Page 18-19] 
is incorrect (it omits a side-condition). 

However, the notion of alpha-equivalence that is preserved by vacuous binders is not always 
wanted. For example in terms like 

let x = 3 and y = 2 in x — y end (1-4) 

we might not care in which order the assignments x = 3 and y = 2 are given, but it would be often 
unusual (particularly in strict languages) to regard (II .41 as alpha-equivalent with 

let x = 3 and y = 2 and z =fao in x — y end 

Therefore we will also provide a separate binding mechanism for cases in which the order of binders 
does not matter, but the 'cardinality' of the binders has to agree. 

However, we found that this is still not sufficient for dealing with language constructs frequently 
occurring in programming language research. For example in lets containing patterns like 

let (x, y) = (3, 2) in x — y end (1-5) 

we want to bind all variables from the pattern inside the body of the let, but we also care about the 
order of these variables, since we do not want to regard (ll.5t as alpha-equivalent with 

let (y, x) = (3, 2) in x — y end 

As a result, we provide three general binding mechanisms each of which binds multiple variables at 
once, and let the user choose which one is intended when formalising a term-calculus. 

By providing these general binding mechanisms, however, we have to work around a problem 
that has been pointed out by Pottier [ 19 ] and Cheney Q: in let-constructs of the form 

let x\ = t\ and . . . and x n = t n in s end 

we care about the information that there are as many bound variables x» as there are t{. We lose this 
information if we represent the let-constructor by something like 

let (Xxi. ..x n .s) [h,. . . ,t n ] 

where the notation A_ . _ indicates that the list of Xj becomes bound in s. In this representation the 
term let (Ax . s) [t\, ?2] is a perfectly legal instance, but the lengths of the two lists do not agree. 
To exclude such terms, additional predicates about well-formed terms are needed in order to ensure 
that the two lists are of equal length. This can result in very messy reasoning (see for example 0). 
To avoid this, we will allow type specifications for lets as follows 

trm ::= . . . 

[ let aswassn s:\trm binds bn(as) in s 

assn ::= anil 

I aeons name trm assn 
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where assn is an auxiliary type representing a list of assignments and bn an auxiliary function 
identifying the variables to be bound by the let. This function can be defined by recursion over 
assn as follows 



The scope of the binding is indicated by labels given to the types, for example sr.tnn, and a binding 
clause, in this case binds bn(as) in s. This binding clause states that all the names the function 
bn{as) returns should be bound in s. This style of specifying terms and bindings is heavily inspired 
by the syntax of the Ott-tool ll22l . Our work extends Ott in several aspects: one is that we support 
three binding modes — Ott has only one, namely the one where the order of binders matters. Another 
is that our reasoning infrastructure, like strong induction principles and the notion of free variables, 
is derived from first principles within the Isabelle/HOL theorem prover. 

However, we will not be able to cope with all specifications that are allowed by Ott. One reason 
is that Ott lets the user specify 'empty' types like t ::= 1 1 \ Ax. t where no clause for variables is 
given. Arguably, such specifications make some sense in the context of Coq's type theory (which 
Ott supports), but not at all in a HOL-based environment where every datatype must have a non- 
empty set-theoretic model [4J. Another reason is that we establish the reasoning infrastructure for 
alpha-equated terms. In contrast, Ott produces a reasoning infrastructure in Isabelle/HOL for non- 
alpha-equated, or 'raw', terms. While our alpha-equated terms and the 'raw' terms produced by Ott 
use names for bound variables, there is a key difference: working with alpha-equated terms means, 
for example, that the two type-schemes 



are not just alpha-equal, but actually equal\ As a result, we can only support specifications that 
make sense on the level of alpha-equated terms (offending specifications, which for example bind a 
variable according to a variable bound somewhere else, are not excluded by Ott, but we have to). 

Our insistence on reasoning with alpha-equated terms comes from the wealth of experience 
we gained with the older version of Nominal Isabelle: for non-trivial properties, reasoning with 
alpha-equated terms is much easier than reasoning with 'raw' terms. The fundamental reason for 
this is that the HOL-logic underlying Nominal Isabelle allows us to replace 'equals-by-equals'. In 
contrast, replacing 'alpha-equals-by-alpha-equals' in a representation based on 'raw' terms requires 
a lot of extra reasoning work. 

Although in informal settings a reasoning infrastructure for alpha-equated terms is nearly al- 
ways taken for granted, establishing it automatically in Isabelle/HOL is a rather non-trivial task. 
For every specification we will need to construct type(s) containing as elements the alpha-equated 
terms. To do so, we use the standard HOL-technique of defining a new type by identifying a non- 
empty subset of an existing type. The construction we perform in Isabelle/HOL can be illustrated 
by the following picture: 



Oft(anil) = 



o«(acons x t as) = {x} U bn(as) 



V {x}. x—ty = V {x, z}. x — > y 




existing 
type 

(sets of raw terms) 



non-empty 
subset 



(1.6) 
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We take as the starting point a definition of raw terms (defined as a datatype in Isabelle/HOL); 
then identify the alpha-equivalence classes in the type of sets of raw terms according to our alpha- 
equivalence relation, and finally define the new type as these alpha-equivalence classes (the non- 
emptiness requirement is always satisfied whenever the raw terms are definable as datatype in Is- 
abelle/HOL and our relation for alpha-equivalence is an equivalence relation). 

The fact that we obtain an isomorphism between the new type and the non-empty subset shows 
that the new type is a faithful representation of alpha-equated terms. That is not the case for example 
for terms using the locally nameless representation of binders [14]: in this representation there are 
'junk' terms that need to be excluded by reasoning about a well-formedness predicate. 

The problem with introducing a new type in Isabelle/HOL is that in order to be useful, a rea- 
soning infrastructure needs to be 'lifted' from the underlying subset to the new type. This is usually 
a tricky and arduous task. To ease it, we re-implemented in Isabelle/HOL ifTOll the quotient package 
described by Homeier [8 1 for the HOL4 system. This package allows us to lift definitions and the- 
orems involving raw terms to definitions and theorems involving alpha-equated terms. For example 
if we define the free-variable function over raw lambda-terms as follows 



then with the help of the quotient package we can obtain a function fv a operating on quotients, that 
is alpha-equivalence classes of lambda-terms. This lifted function is characterised by the equations 



(Note that this means also the term-constructors for variables, applications and lambda are lifted 
to the quotient level.) This construction, of course, only works if alpha-equivalence is indeed an 
equivalence relation, and the 'raw' definitions and theorems are respectful w.r.t. alpha-equivalence. 
For example, we will not be able to lift a bound-variable function. Although this function can be 
defined for raw terms, it does not respect alpha-equivalence and therefore cannot be lifted. To sum 
up, every lifting of theorems to the quotient level needs proofs of some respectfulness properties (see 
j8l). In the paper we show that we are able to automate these proofs and as a result can automatically 
establish a reasoning infrastructure for alpha-equated terms. 

The examples we have in mind where our reasoning infrastructure will be helpful include the 
term language of Core-Haskell (see Figure [TJ. This term language involves patterns that have lists 
of type-, coercion- and term-variables, all of which are bound in case-expressions. In these patterns 
we do not know in advance how many variables need to be bound. Another example is the algorithm 
W, which includes multiple binders in type-schemes. 

Contributions: We provide three new definitions for when terms involving general binders are 
alpha-equivalent. These definitions are inspired by earlier work of Pitts [ 18 1. By means of automati- 
cally-generated proofs, we establish a reasoning infrastructure for alpha-equated terms, including 
properties about support, freshness and equality conditions for alpha-equated terms. We are also 
able to automatically derive strong induction principles that have the variable convention already 
built in. For this we simplify the earlier automated proofs by using the proving tools from the 



M*) * {*} 

Mh h) =>(?i)u>( t2 ) 

Jv()a.t) = f jv(t) ~ to 



Jv a (x) 
Jv a (h h) 



Jv a (t) - {x} 
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Type Kinds 




k ::= 


•k | Kl — > K2 


Coercion Kinds 






Types 




a ::= 


a | T | a\ oi | S n if 1 \ Va:K. a i => a 


Coercion Types 


7 :: = 


c \ C | 71 72 5 n 7™ Vc:t. 7 | t 7 reft a sym 7 | 71 72 
7 @ a \ left 7 | n'g/if 7 | 71 ~ 72 | rightc 7 Ze/to 7 | 71 > 72 


Terms 




e ::= 


x \ K\ Aa:n. e Ac:l. e \ e a \ e 7 | Ax:cr. e\e\e2 
let x:c = ex i n ^2 case of p — > e2 | e > 7 


Patterns 




p :: = 


oTk cIT xTo 


Constants 




C 


coercion constants 


T 


value type constructors 




n-ary type functions (which need to be fully applied) 


K 


data constructors 


Variables 




a 


type variables 


c 


coercion variables 


X 


term variables 



Figure 1: The System Fq |23], also often referred to as Core-Haskell. In this version of Fc we 
made a modification by separating the grammars for type kinds and coercion kinds, as 
well as for types and coercion types. For this paper the interesting term-constructor is 
case, which binds multiple type-, coercion- and term-variables (the overlines stand for 
lists). 



function package [11] of Isabelle/HOL. The method behind our specification of general binders 
is taken from the Ott-tool, but we introduce crucial restrictions, and also extensions, so that our 
specifications make sense for reasoning about alpha-equated terms. The main improvement over Ott 
is that we introduce three binding modes (only one is present in Ott), provide formalised definitions 
for alpha-equivalence and for free variables of our terms, and also derive a reasoning infrastructure 
for our specifications from 'first principles' inside a theorem prover. 

2. A Short Review of the Nominal Logic Work 

At its core, Nominal Isabelle is an adaptation of the nominal logic work by Pitts [17 ]. This adapta- 
tion for Isabelle/HOL is described in [9] (including proofs). We shall briefly review this work to aid 
the description of what follows. 

Two central notions in the nominal logic work are sorted atoms and sort-respecting permuta- 
tions of atoms. We will use the letters a, b, c, . . . to stand for atoms and tt, 7Tl, . . . to stand for 
permutations, which in Nominal Isabelle have type perm. The purpose of atoms is to represent 
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variables, be they bound or free. The sorts of atoms can be used to represent different kinds of 
variables, such as the term-, coercion- and type-variables in Core-Haskell. It is assumed that there 
is an infinite supply of atoms for each sort. In the interest of brevity, we shall restrict ourselves in 
what follows to only one sort of atoms. 

Permutations are bijective functions from atoms to atoms that are the identity everywhere ex- 
cept on a finite number of atoms. There is a two-place permutation operation written _ • _ and 
having the type perm => (3 => /3 where the generic type /3 is the type of the object over which the 
permutation acts. In Nominal Isabelle, the identity permutation is written as 0, the composition of 
two permutations tt\ and Tt2 as it\ + 7T2 (even if this operation is non-commutative), and the inverse 
permutation of 7r as — tt. The permutation operation is defined over Isabelle/HOL's type-hierarchy 
l9l ; for example permutations acting on atoms, products, lists, permutations, sets, functions and 
booleans are given by: 



de f . def 

*'(x,y) = (tt-x, Tr.y) n.X= {tt-x\x£X} 



TT ■ 



def 



7T •/ = Xx. TT • {f (— 7T 'X)) 



(2.1) 



tt • (x:\xs) = (tt •x)::(7r »xs) 71 ~ ■ 



Concrete permutations in Nominal Isabelle are built up from swappings, written as {a b), which are 
permutations that behave as follows: 

(a b) = Ac. if a = c then b else ifb = c then a else c 



The most original aspect of the nominal logic work of Pitts is a general definition for the notion 
of the 'set of free variables of an object x\ This notion, written supp x, is general in the sense that 
it applies not only to lambda-terms (alpha-equated or not), but also to lists, products, sets and even 
functions. Its definition depends only on the permutation operation and on the notion of equality 
defined for the type of x, namely: 

supp x = {a | infinite {b \ (a b) *x ^ x}} (2.2) 
There is also the derived notion for when an atom a is fresh for an x, defined as 

n def , 

a # x = af. supp x 



We use for sets of atoms the abbreviation as #* x, defined as \/ a£as. a # x. A striking consequence 
of these definitions is that we can prove without knowing anything about the structure of x that 
swapping two fresh atoms, say a and b, leaves x unchanged, namely 

Proposition 2.1. If a # x and b # x then (a b) • x = x. 

While often the support of an object can be relatively easily described, for example for atoms, 
products, lists, function applications, booleans and permutations as follows 
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supp a 
supp (x, y) 
supp [] 
supp (x::xs) 



{a} 

supp x U supp y 



supp x U supp xs 



supp (fx) C supp f U supp x 
supp b = 
supp tt = {a | tt • a ^ a} 



(2.3) 



in some cases it can be difficult to characterise the support precisely, and only an approximation can 
be established (as for function applications above). Reasoning about such approximations can be 
simplified with the notion supports, defined as follows: 

Definition 2.2. A set S supports x, if for all atoms a and b not in S we have (a b) • x = x. 
The main point of supports is that we can establish the following two properties. 

Proposition 2.3. Given a set bs of atoms. 

( i) If bs supports x and finite bs then supp x C bs. 

( ii) (supp x) supports x. 

Another important notion in the nominal logic work is equivariance. For a function / to be 
equivariant it is required that every permutation leaves / unchanged, that is 



If a function is of type a =>■ f3, say, this definition is equivalent to the fact that a permutation applied 
to the application fx can be moved to the argument x. That means for such functions, we have for 
all permutations tt: 



There is also a similar property for relations, which are in HOL functions of type a =>■ /3 bool. 
Suppose a relation R, then for all permutations tt: 



Note that from property (12.41 and the definition of supp, we can easily deduce that for a function 
being equivariant is equivalent to having empty support. 

Using freshness, the nominal logic work provides us with general means for renaming binders. 
While in the older version of Nominal Isabelle, we used extensively Proposition ^, ll to rename single 
binders, this property proved too unwieldy for dealing with multiple binders. For such binders the 
following generalisations turned out to be easier to use. 

Proposition 2.4. If supp x #* tt then tt >x = x. 

Proposition 2.5. For a finite set as and a finitely supported x with as x and also a finitely 
supported c, there exists a permutation tt such that tt >as c and supp x tt. 

The idea behind the second property is that given a finite set as of binders (being bound, or fresh, 
in x is ensured by the assumption as x), then there exists a permutation tt such that the renamed 
binders tt • as avoid c (which can be arbitrarily chosen as long as it is finitely supported) and also 
tt does not affect anything in the support of x (that is supp x tt). The last fact and Property 12.41 
allow us to 'rename' just the binders as in x, because tt »x = x. 



Vvr. TT.f =f . 



(2.4) 



TT'f=f if and only if Vjc. tt • (fx) =f (tt »jc) . 



(2.5) 



tt ' R = R if and only if V xy. x Ry implies (tt • x) R (tt • y) . 
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Note that supp x tt is equivalent with supp tt #* x, which means we could also formulate 
Propositions 12.41 and I2.5l in the other 'direction'; however the reasoning infrastructure of Nominal 
Isabelle is set up so that it provides more automation for the formulation given above. 

Most properties given in this section are described in detail in [9] and all are formalised in 
Isabelle/HOL. In the next sections we will make use of these properties in order to define alpha- 
equivalence in the presence of multiple binders. 

3. Abstractions 

In Nominal Isabelle, the user is expected to write down a specification of a term-calculus and then 
a reasoning infrastructure is automatically derived from this specification (remember that Nominal 
Isabelle is a definitional extension of Isabelle/HOL, which does not introduce any new axioms). 

In order to keep our work with deriving the reasoning infrastructure manageable, we will wher- 
ever possible state definitions and perform proofs on the 'user-level' of Isabelle/HOL, as opposed to 
writing custom ML-code that generates them anew for each specification. To that end, we will con- 
sider first pairs (as, x) of type (atom set) x j3. These pairs are intended to represent the abstraction, 
or binding, of the set of atoms as in the body x. 

The first question we have to answer is when two pairs (as, x) and (bs, y) are alpha-equivalent? 
(For the moment we are interested in the notion of alpha-equivalence that is not preserved by adding 
vacuous binders.) To answer this question, we identify four conditions: (i) given a free-atom func- 
tion fa of type j3 => atom set, then (as, x) and (bs, y) need to have the same set of free atoms; 
moreover there must be a permutation tt such that (ii) tt leaves the free atoms of (as, x) and (bs, y) 
unchanged, but ( Hi) 'moves' their bound names so that we obtain modulo a relation, say _ R _, two 
equivalent terms. We also require that (iv) tt makes the sets of abstracted atoms as and bs equal. 
The requirements (i) to (iv) can be stated formally as: 

Definition 3.1 (Alpha-Equivalence for Set-Bindings). 

(as, x) pa f e '/ a (bs, y) = if there exists a tt such that: 

(i) fa x — as = fay — bs 

(ii) fax — as tt 
( Hi) (tt • jc) Ry 

(iv) TT-as = bs 

Note that the relation is dependent on a free-atom function fa and a relation R. The reason for this 
extra generality is that we will use for both raw terms and alpha-equated terms. In the latter 
case, R will be replaced by equality = and we will prove that fa is equal to supp. 

Definition [3j] does not make any distinction between the order of abstracted atoms. If we want 
this, then we can define alpha-equivalence for pairs of the form (as, x) with type (atom list) x j3 as 
follows 

Definition 3.2 (Alpha-Equivalence for List-Bindings). 

(as, x) w f^J a (bs, y) d = if there exists a tt such that: 

f i) fax — set as =fay — set bs 
( ii) fax — set as tt 
( Hi) (tt • jc) Ry 
(iv) tt - as = bs 

where set is the function that coerces a list of atoms into a set of atoms. Now the last clause ensures 
that the order of the binders matters (since as and bs are lists of atoms). 
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If we do not want to make any difference between the order of binders and also allow vacuous 
binders, that means according to Pitts |[T8l restrict atoms, then we keep sets of binders, but drop 
condition (iv) in Definition l3.lt 

Definition 3.3 (Alpha-Equivalence for Set+-Bindings). 

(as, x) R3 f e ' t l a (bs, y) = if there exists a tt such that: 

( i) fax — as = fay — bs 

(ii) fax — as tt 
( Hi) (tt • x) R y 

It might be useful to consider first some examples how these definitions of alpha-equivalence 
pan out in practice. For this consider the case of abstracting a set of atoms over types (as in type- 
schemes). We set R to be the usual equality = and for fa(T) we define 

fa(x) d M {x} fa^ T 2 ) =' ' fa(Ti) Ufa(T 2 ) 

Now recall the examples shown in (11.21 ) and (11.3b . It can be easily checked that ({jc, y}, x — > y) and 
({x, y}, y — > x) are alpha-equivalent according to m set and by taking tt to be the swapping 
(x y). In case of x ^ y, then ([x,y],x—> y) ^u st (\y, x], x — > y) since there is no permutation that 
makes the lists [x, y] and [y, x] equal, and also leaves the type x — > y unchanged. Another example is 
({x}, x) ~ se t+ ({x, y}, x) which holds by taking tt to be the identity permutation. However, rfx^y, 
then ({x}, x) ^ set ({x, y}, x) since there is no permutation that makes the sets {x} and {x, y} equal 
(similarly for « u st ). It can also relatively easily be shown that all three notions of alpha-equivalence 
coincide, if we only abstract a single atom. In this case they also agree with the alpha-equivalence 
used in older versions of Nominal Isabelle [26 1[] 

In the rest of this section we are going to show that the alpha-equivalences really lead to ab- 
stractions where some atoms are bound (or more precisely removed from the support). For this we 
will consider three abstraction types that are quotients of the relations 

(as,x)*Tei supp (bs,y) 

(as,x)^Tei: upp (bs,y) (3.1) 
(a S ,x)Kf d ™PP(b S ,y) 

Note that in these relations we replaced the free-atom function fa with supp and the relation R with 
equality. We can show the following two properties: 

Lemma 3.4. The relations «7et < K '~set+ an d ~7i'sT PP are equivalence relations and equivariant. 

Proof. Reflexivity is by taking tt to be 0. For symmetry we have a permutation tt and for the 
proof obligation take — tt. In case of transitivity, we have two permutations tt\ and TT2, and for the 
proof obligation use tt\ + tt2- Equivariance means (tt • as, tt • x) ~^} supp (tt • bs, tt • y) holds 
provided (as, x) m ^ su P p (bs, y) holds. From the assumption we have a permutation tt' and for the 
proof obligation use tt •tt'. To show equivariance, we need to 'pull out' the permutations, which is 
possible since all operators, namely as #*, — , =, set and supp, are equivariant (see [9|). Finally, 
we apply the permutation operation on booleans. □ 



We omit a proof of this fact since the details are hairy and not really important for the purpose of this paper. 
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Recall the picture shown in (11.61 ) about new types in HOL. The lemma above allows us to use our 
quotient package for introducing new types /3 abs set , (3 abs set -\- and j3 absn st representing alpha- 
equivalence classes of pairs of type (atom set) x /3 (in the first two cases) and of type (atom list) x 
(3 (in the third case). The elements in these types will be, respectively, written as 

[as] set .x [as} set+ jc [as\i ist .x 

indicating that a set (or list) of atoms as is abstracted in x. We will call the types abstraction 
types and their elements abstractions. The important property we need to derive is the support of 
abstractions, namely: 

Theorem 3.5 (Support of Abstractions). Assuming x has finite support, then 

supp [as\ set .x = supp x — as 
supp [as] set +.x = supp x — as 
supp [as]n s[ .x = supp x — set as 

In effect, this theorem states that the atoms as are bound in the abstraction. As stated earlier, this can 
be seen as a litmus test that our Definitions 13.11 I3T21 and I3.3l capture the idea of alpha-equivalence 
relations. Below we will give the proof for the first equation of Theorem [33] The others follow by 
similar arguments. By definition of the abstraction type abs set we have 

[as] set .x = [bs] set .y if and only if (as, x) ^ supp (bs, y) (3.2) 

and also set 

7r . [as]set-x — [?r • as] set .(ir -x) (3.3) 

With this at our disposal, we can show the following lemma about swapping two atoms in an ab- 
straction. 

Lemma 3.6. If a ^ supp x — as and b £ supp x — as then [as] se t-x = [(a b) • as\ se t-((a b) • x) 

Proof. If a = b the lemma is immediate, since (a b) is then the identity permutation. Also in the 
other case the lemma is straightforward using (I3.21 i and observing that the assumptions give us (a 
b) • (supp x — as) = supp x — as. We therefore can use the swapping (a b) as the permutation for 
the proof obligation. □ 

This lemma together with (13.31 ) allows us to show 

(supp x — as) supports [as] set .x (3.4) 

which by Property 12.31 gives us 'one half of Theorem 13.51 To establish the 'other half, we use a 
trick from [ 1 8 ] and first define an auxiliary function aux, taking an abstraction as argument 



aux ([as] set .x) = supp x — as 
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Using the second equation in (12- 5b . we can show that aux is equivariant (since 7r • {supp x — as) = 
supp (vr • x) — 7T • as) and therefore has empty support. This in turn means 

supp {aux ([as]set-x)) Q supp [as] set .x 

using the fact about the support of function applications in (12.31) . Assuming supp x — as is a finite 
set, we further obtain 

supp x — as C supp [as] S et -x (3.5) 

This is because for every finite set of atoms, say bs, we have supp bs = bs^ Finally, taking (13.41) 
and (13.51) together establishes the first equation of Theorem 13.51 The others are similar. 

Recall the definition of support given in (12- 2b . and note the difference between the support of a 
raw pair and an abstraction 

supp {as, x) = supp as U supp x supp [as\ set .x = supp x — as 

While the permutation operations behave in both cases the same (a permutation is just moved to the 
arguments), the notion of equality is different for pairs and abstractions. Therefore we have different 
supports. In case of abstractions, we have established in Theorem l3.5l fhat bound atoms are removed 
from the support of the abstractions' bodies. 

The method of first considering abstractions of the form [as] jgfjc etc is motivated by the fact 
that we can conveniently establish at the Isabelle/HOL level properties about them. It would be 
extremely laborious to write custom ML-code that derives automatically such properties for every 
term-constructor that binds some atoms. Also the generality of the definitions for alpha-equivalence 
will help us in the next sections. 



4. Specifying General Bindings 

Our choice of syntax for specifications is influenced by the existing datatype package of Isabelle/HOL 
[4] and by the syntax of the Ott-tool |[22l . For us a specification of a term-calculus is a collection 
of (possibly mutually recursive) type declarations, say tyf, . . . , ty", and an associated collection 
of binding functions, say bnf, . . . , brim- The syntax in Nominal Isabelle for such specifications is 
schematically as follows: 



type 

declaration part 



binding 
function part 



nominaLdatatype tyf= ... 

and fyf = • • ■ 

and tyn = ■ ■ ■ 

binder bnf and . . . and brim 
where 



(4.1) 



Note that this is not the case for infinite sets. 
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Every type declaration tyf n consists of a collection of term-constructors, each of which comes with 
a list of labelled types that stand for the types of the arguments of the term-constructor. For example 
a term-constructor C a might be specified with 

C a label\::ty' x . . . labelf.ty^ binding _clauses 

whereby some of the ty\ x (or their components) can be contained in the collection of tyf n declared 
in (14.11) . In this case we will call the corresponding argument a recursive argument of C a . The types 
of such recursive arguments need to satisfy a 'positivity' restriction, which ensures that the type has 
a set-theoretic semantics (see H). If the types are polymorphic, we require the type variables to 
stand for types that are finitely supported and over which a permutation operation is defined. The 
labels labeli i annotated on the types are optional. Their purpose is to be used in the (possibly 
empty) list of binding clauses, which indicate the binders and their scope in a term-constructor. 
They come in three modes: 

binds binders in bodies 
binds (set) binders in bodies 
binds (set+) binders in bodies 

The first mode is for binding lists of atoms (the order of bound atoms matters); the second is for 
sets of binders (the order does not matter, but the cardinality does) and the last is for sets of binders 
(with vacuous binders preserving alpha-equivalence). As indicated, the labels in the 'in-part' of a 
binding clause will be called bodies; the 'binds-part' will be called binders. In contrast to Ott, we 
allow multiple labels in binders and bodies. For example we allow binding clauses of the form: 

Foo\ x: -.name y: -.name t: :trm s: :trm binds x y in t s 

F002 x: -.name y: -.name t: :trm s: :trm binds x y in t, binds x y in s 

Similarly for the other binding modes. Interestingly, in case of binds (set) and binds (set+) the bind- 
ing clauses above will make a difference to the semantics of the specifications (the corresponding 
alpha-equivalence will differ). We will show this later with an example. 

There are also some restrictions we need to impose on our binding clauses in comparison to 
Ott. The main idea behind these restrictions is that we obtain a notion of alpha-equivalence where it 
is ensured that within a given scope an atom occurrence cannot be both bound and free at the same 
time. The first restriction is that a body can only occur in one binding clause of a term constructor. 
So for example 

Foo x:\name y:\name t:\trm binds x in t, binds y in t 

is not allowed. This ensures that the bound atoms of a body cannot be free at the same time by 
specifying an alternative binder for the same body. 

For binders we distinguish between shallow and deep binders. Shallow binders are just labels. 
The restriction we need to impose on them is that in case of binds (set) and binds (set+) the labels 
must either refer to atom types or to sets of atom types; in case of binds the labels must refer to atom 
types or to lists of atom types. Two examples for the use of shallow binders are the specification 
of lambda-terms, where a single name is bound, and type-schemes, where a finite set of names is 
bound: 
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nominal-datatype lam = 

Var name 
| App lam lam 

I Lam xv.name tv.lam binds x in t 



nominal-datatype ty = 

TVar name 
| TFun ty ty 



and tsc = 

TAll xs: : (name f set) T: :ty binds (set+) xs in T 



In these specifications name refers to a (concrete) atom type, and j set to the type of finite sets. Note 
that for Lam it does not matter which binding mode we use. The reason is that we bind only a single 
name, in which case all three binding modes coincide. However, having binds (set) or just binds 
in the second case makes a difference to the semantics of the specification (which we will define in 
the next section). 

A deep binder uses an auxiliary binding function that 'picks' out the atoms in one argument of 
the term-constructor, which can be bound in other arguments and also in the same argument (we 
will call such binders recursive, see below). The binding functions are expected to return either a set 
of atoms (for binds (set) and binds (set+)) or a list of atoms (for binds). They need to be defined 
by recursion over the corresponding type; the equations must be given in the binding function part 
of the scheme shown in (14- 1 b - For example a term-calculus containing Lets with tuple patterns may 
be specified as: 



In this specification the function bn determines which atoms of the pattern p (fifth line) are bound 
in the argument t. Note that in the second-last ftrc-clause the function atom coerces a name into the 
generic atom type of Nominal Isabelle [9]. This allows us to treat binders of different atom type 
uniformly. 

For deep binders we allow binding clauses such as 



nominal-datatype trm = 

Var name 
\ App trm trm 

\ Lam x: -.name t:\trm binds x in t 

| Let-pat p:\pat trm tv.trm binds bn(p) in t 



and pat = 

PVar name 
| PTup pat pat 



(4.2) 



binder bnv.pat =4> atom list 



where bn (PVar x) = [atomx] 

| bn[PTup p\ p<i) = bn(pi) @ bn(p2) 



Bar pr.pat tv.trm binds bn(p) in p t 



where the argument of the deep binder also occurs in the body. We call such binders recursive. 
To see the purpose of such recursive binders, compare 'plain' Lets and Let_recs in the following 
specification: 
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nominal-datatype trm = 

| Let as::assn t:\trm binds bn(as) in t 

| Let—rec aswassn t::trm binds bn(as) in as t 
and assn = 

AMI { } 

| ACons name trm assn 
binder bnv.assn => atom list 
where bn{ANU) = [] 

| bn(ACons a t as) = [atom a] @ bn{as) 

The difference is that with Let we only want to bind the atoms bn{as) in the term t, but with Let^rec 
we also want to bind the atoms inside the assignment. This difference has consequences for the 
associated notions of free-atoms and alpha-equivalence. 

To make sure that atoms bound by deep binders cannot be free at the same time, we cannot have 
more than one binding function for a deep binder. Consequently we exclude specifications such as 

Bazi p'-'-pat tv.trm binds bn\(p) bn^ip) in p t 

Baz2 P'-'-pat t\\:trm t^'-'-trm binds bn\{p) in p t\, binds bn2(p) in p t2 

Otherwise it is possible that bn\ and bn2 pick out different atoms to become bound, respectively be 
free, in p^ 

We also need to restrict the form of the binding functions in order to ensure the ft«-functions 
can be defined for alpha-equated terms. The main restriction is that we cannot return an atom in 
a binding function that is also bound in the corresponding term-constructor. Consider again the 
specification for trm and a contrived version for assignments assn: 

nominal-datatype trm = ... 

and assn = 
AMI' 

[ ACons' x:\name y:\name twtrm assn binds y in t (4.4) 
binder bnr.assn => atom list 
where bn(ANil') = [] 

| bn(ACons' x y t as) = [atom x] @ bn(as) 

In this example the term constructor ACons' has four arguments with a binding clause involving 
two of them. This constructor is also used in the definition of the binding function. The restriction 
we have to impose is that the binding function can only return free atoms, that is the ones that are 
not mentioned in a binding clause. Therefore y cannot be used in the binding function bn (since 
it is bound in ACons' by the binding clause), but x can (since it is a free atom). This restriction is 
sufficient for lifting the binding function to alpha-equated terms. If we would permit bn to return y, 
then it would not be respectful and therefore cannot be lifted to alpha-equated lambda-terms. 

In the version of Nominal Isabelle described here, we also adopted the restriction from the Ott- 
tool that binding functions can only return: the empty set or empty list (as in case AMI), a singleton 
set or singleton list containing an atom (case PVar in (14.21 )). or unions of atom sets or appended 



Since the Ott-tool does not derive a reasoning infrastructure for alpha-equated terms with deep binders, it can permit 
such specifications. 
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atom lists (case ACons 1 ). This restriction will simplify some automatic definitions and proofs later 
on. 

To sum up this section, we introduced nominal datatype specifications, which are like standard 
datatype specifications in Isabelle/HOL but extended with binding clauses and specifications for 
binding functions. Each constructor argument in our specification can also have an optional label. 
These labels are used in the binding clauses of a constructor; there can be several binding clauses 
for each constructor, but bodies of binding clauses can only occur in a single one. Binding clauses 
come in three modes: binds, binds (set) and binds (set+). Binders fall into two categories: shallow 
binders and deep binders. Shallow binders can occur in more than one binding clause and only have 
to respect the binding mode (i.e. be of the right type). Deep binders can also occur in more than 
one binding clause, unless they are recursive in which case they can only occur once. Each of the 
deep binders can only have a single binding function. Binding functions are defined by recursion 
over a nominal datatype. They can return the empty set, singleton atoms and unions of sets of atoms 
(for binding modes binds (set) and binds (set+)), and the empty list, singleton atoms and appended 
lists of atoms (for mode bind). However, they can only return atoms that are not mentioned in any 
binding clause. 

In order to simplify our definitions of free atoms and alpha-equivalence we define next, we 
shall assume specifications of term-calculi are implicitly completed. By this we mean that for every 
argument of a term-constructor that is not already part of a binding clause given by the user, we add 
implicitly a special empty binding clause, written binds in labels. In case of the lambda-terms, 
the completion produces 

nominal-datatype lam = 

Var xwname binds in x 
| App t\\:lam t^.'.lam binds in t\ ?2 
| Lam xwname t:\lam binds x in t 

The point of completion is that we can make definitions over the binding clauses and be sure to have 
captured all arguments of a term constructor. 

5. Alpha-Equivalence and Free Atoms 

Having dealt with all syntax matters, the problem now is how we can turn specifications into actual 
type definitions in Isabelle/HOL and then establish a reasoning infrastructure for them. As Pot- 
tier and Cheney pointed out [191, just re-arranging the arguments of term-constructors so that 
binders and their bodies are next to each other will result in inadequate representations in cases 
like Let xi = t\. . .x n = t n in s. Therefore we will first extract 'raw' datatype definitions from the 
specification and then define explicitly an alpha-equivalence relation over them. We subsequently 
construct the quotient of the datatypes according to our alpha-equivalence. 

The 'raw' datatype definition can be obtained by stripping off the binding clauses and the labels 
from the types given by the user. We also have to invent new names for the types ty a and the term- 
constructors C a . In our implementation we just use the affix "_raw". But for the purpose of this 
paper, we use the superscript _ a to indicate that a notion is given for alpha-equivalence classes and 
leave it out for the corresponding notion given on the raw level. So for example we have ty a / ty and 
C a I C where ty is the type used in the quotient construction for ty a and C is the term-constructor 
of the raw type ty, respectively C a is the corresponding term-constructor of ty a . 

The resulting datatype definition is legal in Isabelle/HOL provided the datatypes are non-empty 
and the types in the constructors only occur in positive position (see [4 ] for an in-depth description of 
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the datatype package in Isabelle/HOL). We subsequently define each of the user-specified binding 
functions bn\__ m by recursion over the corresponding raw datatype. We also define permutation 
operations by recursion so that for each term constructor C we have that 

n- (Czi ■ ■ ■ Z n ) = C (tt-Zi) . . . (TT-Zn) (5.1) 

We will need this operation later when we define the notion of alpha-equivalence. 

The first non-trivial step we have to perform is the generation of free-atom functions from the 
specifications^ For the raw types ?yi..n we define the free-atom functions 

fa-tyi.. n (5.2) 

by recursion. We define these functions together with auxiliary free-atom functions for the binding 
functions. Given raw binding functions bn\„ m we define 

fa_bn x .. m . 

The reason for this setup is that in a deep binder not all atoms have to be bound, as we saw in (14.31 ) 
with the example of 'plain' Lets. We need therefore functions that calculate those free atoms in deep 
binders. 

While the idea behind these free-atom functions is simple (they just collect all atoms that are 
not bound), because of our rather complicated binding mechanisms their definitions are somewhat 
involved. Given a raw term-constructor C of type ty and some associated binding clauses bc\ . . . bck, 
the result of fa_ty (C z.\ ■ ■ ■ z n ) will be the union/<2(&ci ) U . . . Ufa(bck ) where we will define below 
what fa for a binding clause means. We only show the details for the mode binds (set) (the other 
modes are similar). Suppose a binding clause bci is of the form 

binds (set) b\ . . . b p in d\ . . . d q 

in which the body-labels d\.. q refer to types tyi.. q , and the binders b\__ v either refer to labels of atom 
types (in case of shallow binders) or to binding functions taking a single label as argument (in case 
of deep binders). Assuming D stands for the set of free atoms of the bodies, B for the set of binding 
atoms in the binders and B' for the set of free atoms in non-recursive deep binders, then the free 
atoms of the binding clause bci are 

faiba) = (D - B) U B'. (5.3) 

The set D is formally defined as 

def 

D = fa-tyi d\ U ... Ufa_ty q d q 



Admittedly, the details of our definitions will be somewhat involved. However they are still conceptually simple in 
comparison with the 'positional' approach taken in Ott 11221 Pages 88-95], which uses the notions of occurrences and 
partial equivalence relations over sets of occurrences. 
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where in case d% refers to one of the raw types fyi..n from the specification, the function fa_tyi is the 

def 

corresponding free-atom function we are defining by recursion; otherwise we set fa_tyi = supp. 
The reason for the latter is that tyi is not a type that is part of the specification, and we assume 
supp is the generic function that characterises the free variables of a type (in fact in the next section 
we will show that the free-variable functions we define here, are equal to the support once lifted to 
alpha-equivalence classes). 

In order to formally define the set B we use the following auxiliary ^-functions for atom types 
to which shallow binders may refer 

briatom a 
btlatomset as 
b n atom_List as 

Like the function atom, the function atoms coerces a set of atoms to a set of the generic atom type. 
It is defined as atoms as = {atom a \ a G as}. The set B in (15.31 ) is then formally defined as 

B = bn_ty 1 b\ U ... U bn_ty p b p (5.5) 

where we use the auxiliary binding functions from (15.41 ) for shallow binders (that means when tyi is 
of type atom, atom set or atom list). 

The set B' in (15.31) collects all free atoms in non-recursive deep binders. Let us assume these 
binders in the binding clause bet are 

bti\ l\, . . . , bn r l r 

with l\ /r C b±„p and none of the l\„ r being among the bodies d\„ q . The set B' is defined as 

B' = faJbni h U ... UfaJbn r l r (5.6) 

This completes all clauses for the free-atom functions fa_tyi^ n . 

Note that for non-recursive deep binders, we have to add in (15.31 ) the set of atoms that are left un- 
bound by the binding functions bn\, m . We used for the definition of this set the f unctions faJbn\^ m . 
The definition for those functions needs to be extracted from the clauses the user provided for bn\„ m 
Assume the user specified a ftrc-clause of the form 

bn (C z,\ ■ ■ ■ Z s ) = rhs 

where the z.i.. s are of types fyi..s- For each of the arguments we calculate the free atoms as follows: 

• fa_tyi z,i provided z% does not occur in rhs 

(that means nothing is bound in z.i by the binding function), 

• faJbrii Zi provided z% occurs in rhs with the recursive call btii z% 
(that means whatever is 'left over' from the &«-function is free) 

• provided z.% occurs in rhs, but without a recursive call 

(that means z.i is supposed to become bound by the binding function) 



= {atom a} 



def 

atoms (set as) 



atoms as 

(5.4) 

def 
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For defining fa_bn (C z\ • • • z n ) we just union up all these sets. 

To see how these definitions work in practice, let us reconsider the term-constructors Let and 
Let-rec shown in (14.31) together with the term-constructors for assignments AMI and ACons. Since 
there is a binding function defined for assignments, we have three free-atom functions, namely fcitrm^ 
fa asS n ^dfa bn as follows: 

def 

fa trm (Let as t) = (fa trm t — set (bn as)) Ufa bri as 

def 

fa t rm (Let_rec as t) = (fa assn as Ufa trm t) — set (bn as) 

fdassn (AMI) = y 

fa a ssn (ACons at as) = (supp a) U (fa trm t) U (fa assn as) 

def 

fa bn (AMI) = 

fa bn (ACons a t as) = (fa trm t) U (fa bn as) 

Recall that AMI and ACons have no binding clause in the specification. The corresponding free- 
atom function fa aS sn therefore returns all free atoms of an assignment (in case of ACons, they are 
given in terms of supp,fa trm ^^fa a ssn)- The binding only takes place in Let and Let_rec. In case of 
Let, the binding clause specifies that all atoms given by set (bn as) have to be bound in t. Therefore 
we have to subtract set (bn as) from fa trm t. However, we also need to add all atoms that are free 
in as. This is in contrast with Let_rec where we have a recursive binder to bind all occurrences of 
the atoms in set (bn as) also inside as. Therefore we have to subtract set (bn as) from both fa trm t 
wAfa assn as. Like the function bn, the function fa bn traverses the list of assignments, but instead 
returns the free atoms, which means in this example the free atoms in the argument t. 

An interesting point in this example is that a 'naked' assignment (AMI or ACons) does not bind 
any atoms, even if the binding function is specified over assignments. Only in the context of a Let 
or Let-rec, where the binding clauses are given, will some atoms actually become bound. This is a 
phenomenon that has also been pointed out in |[22l . For us this observation is crucial, because we 
would not be able to lift the fen-functions to alpha-equated terms if they act on atoms that are bound. 
In that case, these functions would not respect alpha-equivalence. 

Having the free-atom functions at our disposal, we can next define the alpha-equivalence rela- 
tions for the raw types ty\„ n . We write them as 

Like with the free-atom functions, we also need to define auxiliary alpha-equivalence relations 

for the binding functions bn\^ m , To simplify our definitions we will use the following abbreviations 
for compound equivalence relations and compound free-atom functions acting on tuples. 

def 

(xi,...,x n ) (R 1 ,...,R n ) (y 1 ,...,y n ) = x 1 Ri yi A . . . A x n R n y n 

def 

(fai,. . . Ja n ) (x 1 ,. ..,x n ) = fax x x U . . . Ufa n x n 
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The alpha-equivalence relations are defined as inductive predicates having a single clause for 
each term-constructor. Assuming a term-constructor C is of type ty and has the binding clauses 
bc\__^, then the alpha-equivalence clause has the form 

prems{bci) . . . prems{bck) 



C Zl ■ ■ ■ Zn ~ty C Zl ■ ■ ■ Z'n (5.7) 

The task below is to specify what the premises corresponding to a binding clause are. To understand 
better what the general pattern is, let us first treat the special instance where bc{ is the empty binding 
clause of the form 

binds (set) in d\. . . d q . 

In this binding clause no atom is bound and we only have to 'alpha-relate' the bodies. For this we 

build first the tuples D = (di,. . . , d q ) and D' = (d'i,. . . , d' q ) whereby the labels d\__ q refer to some 
of the arguments z\.. n an d respectively d\,_ q to some of the z'\ „ n in (15.7I ). In order to relate two such 
tuples we define the compound alpha-equivalence relation R as follows 

R d = f (R u ...,R q ) (5.8) 

with Ri being fyfyj if the corresponding labels di and d'i refer to a recursive argument of C and 
have type tyf, otherwise we take Ri to be the equality =. Again the latter is because tyi is then 
not part of the specified types and alpha-equivalence of any previously defined type is supposed to 
coincide with equality. This lets us now define the premise for an empty binding clause succinctly 

def 

as prems{bci) = D R D', which can be unfolded to the series of premises 

d\ R\ d\ . . . d q R q d' q . 

We will use the unfolded version in the examples below. 

Now suppose the binding clause bc,i is of the general form 

binds (set) b\ . . . b p in d\ . . . d q . (5.9) 

In this case we define a premise P using the relation given in Section [3] (similarly and 
~«vT f° r tne otrier binding modes). As above, we first build the tuples D and D' for the bodies 
di__ q , and the corresponding compound alpha-relation R (shown in (15.8I )). For we also need a 
compound free-atom function for the bodies defined as 

fa = (fa_tyi,. . . ,fa_ty q ) 

with the assumption that the d\„ q refer to arguments of types ty\.. q . The last ingredient we need are 
the sets of atoms bound in the bodies. For this we take 

B = bn_tyi biU . . . U bn_ty p b p . 



GENRAL BINDINGS 



21 



Similarly for B' using the labels bi__ p . This lets us formally define the premise P for a non-empty 
binding clause as: 

P t f { B,D)^/ a (B',D r ). 

This premise accounts for alpha-equivalence of the bodies of the binding clause. However, in case 
the binders have non-recursive deep binders, this premise is not enough: we also have to 'propagate' 
alpha-equivalence inside the structure of these binders. An example is Let where we have to make 
sure the right-hand sides of assignments are alpha-equivalent. For this we use relations ~fefti.. m 
(which we will define shortly). Let us assume the non-recursive deep binders in bci are 

bn\ li, . . . , bn r l r . 

The tuple L consists then of all these binders (l\ ,. . . ,/ r ) (similarly L') and the compound equivalence 
relation /?'is (mbni,. . . ,&bn r ). All premises for bci are then given by 

prems{bci) = P A LR'L' 

The auxiliary alpha-equivalence relations ~&«i.. m in 7?'are defined as follows: assuming a ftrc-clause 
is of the form 

bn (C z.\ ■ ■ ■ Zs) = rhs 

where the zi.. s are of types fyi..s> then the corresponding alpha-equivalence clause for mbn has the 
form 

Zl Rl z'l ■■■ Zs R s z' s 
Czi ... Z s ~bn Cz'i ■ ■ ■ Zs 

In this clause the relations Ri__ s are given by 

• Zi ~fy zi provided Zi does not occur in rhs and is a recursive argument of C, 

• Zi = Zi provided z% does not occur in rhs and is a non-recursive argument of C, 

• z.i ~brii z'i provided z% occurs in rhs with the recursive call brii x% and 

• True provided z% occurs in rhs but without a recursive call. 

This completes the definition of alpha-equivalence. As a sanity check, we can show that the premises 
of empty binding clauses are a special case of the clauses for non-empty ones (we just have to unfold 
the definition of and take for the existentially quantified permutation). 

Again let us take a look at a concrete example for these definitions. For the specification shown 
in ( 14.31 ) we have three relations ~ frm , ~ ass « and with the following rules: 
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(bn as, t) f/rm,fa trm ^ bn as i^ f tj as QS i 



Let as t 



Let as' t 



(bn OS, (as, t)) ^{^ t assn ' ~t™n), (faassn,fa trm ) ( bn as i^ ^ j/^ 
Let_rec as t &trm Let_rec as' t' 



ANil ttassn ANil 



a = a 



as 



as 



ACons a t as 



ACons a' t as 



(5.10) 



as as 



ANil 



J bn 



ANil ACons at as ACons a' t' as 



Notice the difference between and r^„: the latter only 'tracks' alpha-equivalence of the com- 
ponents in an assignment that are not bound. This is needed in the clause for Let (which has a 
non-recursive binder). The underlying reason is that the terms inside an assignment are not meant 
to be 'under' the binder. Such a premise is not needed in Let_rec, because there all components of 
an assignment are 'under' the binder. Note also that in case of more than one body (that is in the 
Let_rec-ca.se. above) we need to parametrise the relation with a compound equivalence relation 
and a compound free-atom function. This is because the corresponding binding clause specifies a 
binder with two bodies, namely as and t. 



6. Establishing the Reasoning Infrastructure 

Having made all necessary definitions for raw terms, we can start with establishing the reasoning 
infrastructure for the alpha-equated types tyi.. n , that is the types the user originally specified. We 
give in this section and the next the proofs we need for establishing this infrastructure. One point of 
our work is that we have completely automated these proofs in Isabelle/HOL. 

First we establish that the free-variable functions, the binding functions and the alpha-equiva- 
lences are equivariant. 

Lemma 6.1. 

(i) The functions fa_ty\ M , fa _bn\.. m and bn\„ m are equivariant. 

(ii) The relations ~fyi..n and ~bn\„ m are equivariant. 

Proof. The function package of Isabelle/HOL allows us to prove the first part by mutual induction 
over the definitions of the functions^ The second is by a straightforward induction over the rules of 
~fyi.. n and ~bn\.. m using the first part. □ 

Next we establish that the alpha-equivalence relations defined in the previous section are indeed 
equivalence relations. 

Lemma 6.2. The relations ~fyi..n ond ~^«i.. m are equivalence relations. 

Proof. The proofs are by induction. The non-trivial cases involve premises built up by ~ set , ~ S et+ 
and ~ust- They can be dealt with as in Lemma [341 However, the transitivity case needs in addition 
the fact that the relations are equivariant. □ 



'We have that the free-atom functions are terminating. From this the function package derives an induction principle 11 1 1 . 
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We can feed the last lemma into our quotient package and obtain new types ty± n representing 
alpha-equated terms of types ?yi..n- We also obtain definitions for the term-constructors C° k from 
the raw term-constructors C\ and similar definitions for the free-atom functions faSy\ n and 
faJbnf m as well as the binding functions bnf m . However, these definitions are not really useful 
to the user, since they are given in terms of the isomorphisms we obtained by creating new types in 
Isabelle/HOL (recall the picture shown in the Introduction). 

The first useful property for the user is the fact that distinct term-constructors are not equal, that 
is the property 

C a x x ... x r ^D a yi ... y s (6.1) 

whenever C a ^ D a . In order to derive this property, we use the definition of alpha-equivalence and 
establish that 

Cx\ ... x r tfbty Dyi . . . y s (6.2) 

holds for the corresponding raw term-constructors. In order to deduce (I6.11 l from (I6.21 i. our quo- 
tient package needs to know that the raw term-constructors C and D are respectful w.r.t. the alpha- 
equivalence relations (see [8]). Given, for example, C is of type ty with argument types tyx„ r , 
respectfulness amounts to showing that 

C x\ ... x r ~fy C jci ... x' r 

holds under the assumptions Xi ~fyi x 'i whenever x% and x\ are recursive arguments of C, and jtj = x\ 
whenever they are non-recursive arguments (similarly for D). For this we have to show by induction 
over the definitions of alpha-equivalences the following auxiliary implications 



X ' 


atyi x' 


implies 


fa-tyi x =fa_tyi x' 


X r 


atyix' 


implies 


fa_brij x =fa_btij x' 


X r r 


atyi x' 


implies 


brij x = btij x' 


X r 


atyix' 


implies 


x ~brij x' 



(6.3) 



whereby tyi is the type over which brij is defined. Whereas the first, second and last implication are 
true by how we stated our definitions, the third only holds because of our restriction imposed on the 
form of the binding functions — namely not to return any bound atoms. In Ott, in contrast, the user 
may define bn\^ m so that they return bound atoms and in this case the third implication is not true. 
A result is that in general the lifting of the corresponding binding functions in Ott to alpha-equated 
terms is impossible. Having established respectfulness for the raw term-constructors, the quotient 
package is able to automatically deduce (16.11 ) from (I6.2I ). 

Next we can lift the permutation operations defined in (I5.lt . In order to make this lifting to go 
through, we have to show that the permutation operations are respectful. This amounts to showing 
that the alpha-equivalence relations are equivariant, which we already established in Lemma 16.21 
As a result we can add the equations 



7T • (C a X\ . . . X r ) = C a (n • JCi) . . . ("7T ' X r ) 



(6.4) 
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to our infrastructure. In a similar fashion we can lift the defining equations of the free-atom functions 
/a_fyi..n and/a_Z??2i.. m as well as of the binding functions bn\,, m and size functions sizeuty\,, n . The 
latter are defined automatically for the raw types ty±„ n by the datatype package of Isabelle/HOL. 
We also need to lift the properties that characterise when two raw terms of the form 

C x\ ... x r ~fy C x'\ ... x' r 

are alpha-equivalent. This gives us conditions when the corresponding alpha-equated terms are 
equal, namely 

We call these conditions quasi-injectivity. They correspond to the premises in our alpha-equivalence 
relations, except that the relations ~fyi..n are all replaced by equality (and similarly the free-atom 
and binding functions are replaced by their lifted counterparts). Recall the alpha-equivalence rules 
for Let and Let_rec shown in (15.101) . For Let a and Let_rec a we have 

(bn a as, t) « j[ s / a ' rm (bn as',t r ) as as' 
Let a as t = Let a as' t' 

(6.5) 

(bn a as, (as, i)) « =)> (fi&snjaftm) (p n a aj / 
Let_rec a as t = Let_rec a as' t' 

We can also add to our infrastructure cases lemmas and a (mutual) induction principle for the 
types fyi..n- The cases lemmas allow the user to deduce a property P by exhaustively analysing 
how an element of a type, say tyf, can be constructed (that means one case for each of the term- 
constructors in tyf). The lifted cases lemma for a type tyf looks as follows 

V*i. ..x k .y = Cfxi ... x k ^P 

Vxi. . .XI. y = CfnXi ... Xi^P 

P (6.6) 

where y is a variable of type tyf and P is the property that is established by the case analysis. 
Similarly, we have a (mutual) induction principle for the types tyf__ n , which is of the form 

M x\. . .Xk- P%Xi A . . . A Pj xj P (C\ x\ . . . Xk) 

Vxi- . .Xi- P r X r A . . . A P s X s P (Cfn X\ . . . Xl) 

Pi Vi A . . . A P n y n (6.7) 

whereby the P\.. n are the properties established by the induction, and the y\„ n are of type tyf,, n . 
Note that for the term constructor C° the induction principle has a hypothesis of the form 

Vxi. . .Xk- Pi Xi A . . . A Pj Xj =^ P (C\X\ . . . Xk) 
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in which the x%.,j C xi..fc are the recursive arguments of this term constructor (similarly for the other 
term-constructors) . 

Recall the lambda-calculus with Le?-patterns shown in (14.2b - The cases lemmas and the induc- 
tion principle shown in (16.61 ) and (16.71 ) boil down in that example to the following three inference 
rules: 

cases lemmas: 

\/ x.y = Var a x => P trm 
\J Xl X 2 .y= App a X 1 X 2 =¥■ Ptrm 

Vjci X2- y = Lam a x% x 2 => Ptrm Vx. y = PVar a x P pat 



Vxi x 2 X3. y = Let_pat a x\ x 2 X3 P trm Vxi x 2 .y = PTup a x\ x 2 => P 



pat 



Ptrm Ppat 
induction principle: ^ ^ 

Vx. (Var Q x) 

Vxi X 2 . Ptrm Xi A Pfrm X 2 => Ptrm (App a X\ X 2 ) 

Vxi x 2 . Pfrm x 2 ^> Pfrm (Z,am a Xi x 2 ) 

Vxi X 2 X 3 . P paf XI A Ptrm *2 A 

Pfrm X3 Pfrm {Let_pat a x\ x 2 x 3 ) 

Vx. P pflf (PVar Q x) 

Vxi X 2 . P pa t Xi A P paf X 2 ^> P pat (PTup a Xl X 2 ) 

Pfrm >'l A P paf y 2 

By working now completely on the alpha-equated level, we can first show using (|6.41 i and 
Property |2. II that the support of each term constructor is included in the support of its arguments, 
namely 

(supp x\ U . . . U supp x r ) supports (C a x\ ... x r ) 

This allows us to prove using the induction principle for tyf„ n that every element of type fyi.. n 
is finitely supported (using Proposition 12.31 7)). Similarly, we can establish by induction that the 
free-atom functions and binding functions are equivariant, namely 

7r.(/a_fy?x) = fa_tyf (it ' x) 
tt • {faJbnJ x) = faJbriJ (tt • x) 
7r • (bnf x) = bnj (tt • x) 

Lastly, we can show that the support of elements in fyfLn i s tne same as the free-atom functions 
fa_tyi,, n . This fact is important in the nominal setting where the general theory is formulated in 
terms of support and freshness, but also provides evidence that our notions of free-atoms and alpha- 
equivalence 'match up' correctly. 

Theorem 6.3. For xi.. n with type tyf„ n , we have supp Xj =/a_fy?Xj. 

Proof. The proof is by induction on Xi.. n . In each case we unfold the definition of supp, move 
the swapping inside the term-constructors and then use the quasi-injectivity lemmas in order to 
complete the proof. For the abstraction cases we use then the facts derived in Theorem 13.51 for 
which we have to know that every body of an abstraction is finitely supported. This, we have proved 
earlier. □ 
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Consequently, we can replace the free-atom functions by supp in our quasi-injection lemmas. In the 
examples shown in (16.51) . for instance, we obtain for Let a and Let_rec a 

(bn a as, t) « ,=} m PP (bn a as', t') as as 1 
Let a as t = Let a as' t' 

(bn a as, (as, t)) « jg> =). ( S HPP. W>P) (bn a as', (as, t')) 
Let_rec a as t = Let—rec a as' t' 

Taking into account that the compound equivalence relation (=, =) and the compound free-atom 
function (supp, supp) are by definition equal to = and supp, respectively, the above rules simplify 
further to 

[bn a as]i ist .t = [bn a as]i^_ as as' 
Let a as t = Let a as' t' 

[bn a as]i ist .(as, t) = [bn a as1n st .(as, t*) 
Let_rec a as t = Let—rec a as' t' 

which means we can characterise equality between term-constructors (on the alpha-equated level) 
in terms of equality between the abstractions defined in Section [3] From this we can deduce the 
support for Let a and Let_rec a , namely 

supp (Let - as i) = (supp t — set (bn a as)) Ufa a n as 
supp (Let_rec a as t) = (supp t U supp as) — set (bn a as) 

using the support of abstractions derived in Theorem 13.51 

To sum up this section, we have established a reasoning infrastructure for the types fyf..n by 
first lifting definitions from the 'raw' level to the quotient level and then by proving facts about 
these lifted definitions. All necessary proofs are generated automatically by custom ML-code. 



7. Strong Induction Principles 

In the previous section we derived induction principles for alpha-equated terms (see (16.71 ) for the 
general form and (16.81 ) for an example). This was done by lifting the corresponding inductions 
principles for 'raw' terms. We already employed these induction principles for deriving several facts 
about alpha-equated terms, including the property that the free-atom functions and the notion of 
support coincide. Still, we call these induction principles weak, because for a term-constructor, say 
C a x\. . .x r , the induction hypothesis requires us to establish (under some assumptions) a property 
P (C a X\. . . Xr) for all Xi„ r . The problem with this is that in the presence of binders we cannot make 
any assumptions about the atoms that are bound — for example assuming the variable convention. 
One obvious way around this problem is to rename bound atoms. Unfortunately, this leads to very 
clunky proofs and makes formalisations grievous experiences (especially in the context of multiple 
bound atoms). 

For the older versions of Nominal Isabelle we described in ll26l a method for automatically 
strengthening weak induction principles. These stronger induction principles allow the user to make 
additional assumptions about bound atoms. The advantage of these assumptions is that they make in 
most cases any renaming of bound atoms unnecessary. To explain how the strengthening works, we 



GENRAL BINDINGS 



27 



use as running example the lambda-calculus with Lef-patterns shown in (14.2l i. Its weak induction 
principle is given in (I6.8I ). The stronger induction principle is as follows: 

Vx C. P t rm c (Var a x) 

Vxi x 2 c. (yd. P trm dx{) A (\/d. P trm d x 2 ) => Ptrm c (App a x\ x 2 ) 
Vxi x 2 c. atom x\ c A (yd. Ptrm dx 2 ) => Ptrm c (Lam a x\ x 2 ) 
Vxi x 2 X3 c. (set (bn a xi)) #* c A 

(yd. Pp a t dxi) A (Vd. P trm d X 2 ) A (yd. Ptrm d X3) => P frm C (Let_pat a X\ X 2 X3) 
Vx c. c (PVar a x) 

Vjci x 2 c. (V<i. Ppaf dxi) A (V<i. P pa tdx 2 ) => P pa? c (PTup a x\ x 2 ) 

Ptrm C y\ A P paf C J 2 

(7.1) 

Notice that instead of establishing two properties of the form Ptrm Ji A P pat y 2 , as the weak one 
does, the stronger induction principle establishes the properties of the form Ptrm c y\ A P pa t c y 2 in 
which the additional parameter c is assumed to be of finite support. The purpose of c is to 'control' 
which freshness assumptions the binders should satisfy in the Lam a and Let_pat a cases: for Lam a 
we can assume the bound atom x\ is fresh for c (third line); for Let_pat a we can assume all bound 
atoms from an assignment are fresh for c (fourth line). In order to see how an instantiation for c 
in the conclusion 'controls' the premises, one has to take into account that Isabelle/HOL is a typed 
logic. That means if c is instantiated with, for example, a pair, then this type-constraint will be 
propagated to the premises. The main point is that if c is instantiated appropriately, then the user 
can mimic the usual convenient 'pencil-and-paper' reasoning employing the variable convention 
about bound and free variables being distinct [26]. 

In what follows we will show that the weak induction principle in (16.81 ) implies the strong 
one (IV -lb - This fact was established for single binders in ll26l by some quite involved, nevertheless 
automated, induction proof. In this paper we simplify the proof by leveraging the automated proving 
tools from the function package of Isabelle/HOL [11]. The reasoning principle behind these tools is 
well-founded induction. To use them in our setting, we have to discharge two proof obligations: one 
is that we have well-founded measures (one for each type tyf n ) that decrease in every induction 
step and the other is that we have covered all cases in the induction principle. Once these two proof 
obligations are discharged, the reasoning infrastructure of the function package will automatically 
derive the stronger induction principle. This way of establishing the stronger induction principle is 
considerably simpler than the earlier work presented in |]26"i . 

As measures we can use the size functions size-tyf n , which we lifted in the previous section 
and which are all well-founded. It is straightforward to establish that the sizes decrease in every 
induction step. What is left to show is that we covered all cases. To do so, we have to derive 
stronger cases lemmas, which look in our running example as follows: 

Vx. y = Var a x P trm 

Vxi X 2 . y = App a Xi X 2 => Ptrm 

Vxi x 2 . atom x\ # c Ay = Lam a x\ x 2 =>■ Ptrm Vx. y = PVar a x P pa t 

Vxi x 2 X3. set (bn a x\) c Ay = Let_pat a x\ x 2 X3 =>■ Ptrm Vxi x%. y = PTup a xi x 2 => P pat 

Ptrm Ppat 

They are stronger in the sense that they allow us to assume in the Lam a and Let_pat a cases that the 
bound atoms avoid, or are fresh for, a context c (which is assumed to be finitely supported). 
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These stronger cases lemmas can be derived from the 'weak' cases lemmas given in (16.81) . This 
is trivial in case of patterns (the one on the right-hand side) since the weak and strong cases lemma 
coincide (there is no binding in patterns). Interesting are only the cases for Lam a and Let_pat a , 
where we have some binders and therefore have an additional assumption about avoiding c. Let us 
first establish the case for Lam a . By the weak cases lemma (16.81 ) we can assume that 

y = Lam a xi X2 (7.2) 

holds, and need to establish Pt rm . The stronger cases lemma has the corresponding implication 

Vxi %2- atom x\ # c A y = Lam a x\ X2 => Ptrm (7-3) 

which we must use in order to infer Ptrm- Clearly, we cannot use this implication directly, because 
we have no information whether or not x\ is fresh for c. However, we can use Properties I2.4l and 12.51 
to rename x\. We know by Theorem [673] that {atom x\ \ #* Lam a x\ xi (since its support is supp x^ 
— {atom x\}). Property l2.5l provides us then with a permutation ir, such that {atom (tt >x±)} #* c 
and supp (Lam a x\ x-i) #* tt hold. By using Property [2.41 we can infer from the latter that 

Lam a (ir • x\ ) (ir •JC2) = Lam a x\X2 

holds. We can use this equation in the assumption (I7.2I ). and hence use the implication (17.31 ) with 
the renamed ir • x\ and it • X2 for concluding this case. 

The Let-pat a -case involving a deep binder is slightly more complicated. We have the assump- 
tion 

y = Let—pat a x% X2 X3 (7.4) 

and the implication from the stronger cases lemma 

Vxi X2 X3. set (bn a x\) #* c Ay = Let_pat a x\ X2 X3 Ptrm (7-5) 

The reason that this case is more complicated is that we cannot directly apply Property 12.51 for 
obtaining a renaming permutation. Property [23] requires that the binders are fresh for the term in 
which we want to perform the renaming. But this is not true in terms such as (using an informal 
notation) 

Let (x,y) := (x, y) in (x, y) 

where x and y are bound in the term, but are also free in the right-hand side of the assignment. We 
can, however, obtain such a renaming permutation, say ir, for the abstraction [bn a xi]n st .x^. As a 
result we have set (bn a (ir 'X\)) #* c and [bn a (ir • x\)\n st .(ir >x^) = [bn a X\]u st -Xz (remember set 
and bn a are equivariant). Now the quasi-injective property for Let_pat a states that 

[bn a p] list . t 2 = [bn a p] list . t' 2 p «g„ p' h = A 
Let_pat a p t\ t2 = Let_pat a pWi t'2 
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Since all atoms in a pattern are bound by Let_pat a , we can infer that (tt «jci) x\ holds for every 
7T. Therefore we have that 

Let_pat a (tt >x\) X2 (it »x^) = Let_pat a x\ X2 X3 

Taking the left-hand side in the assumption shown in (17.4b . we can use the implication (17.51) from 
the stronger cases lemma to infer Ptrm, as needed. 

The remaining difficulty is when a deep binder contains some atoms that are bound and some 
that are free. An example is Let a in (14.3I ). In such cases (tt -xi) x\ does not hold in general. The 
idea however is that tt only renames atoms that become bound. In this way tt does not affect 
(which only tracks alpha-equivalence of terms that are not under the binder). However, the problem 
is that the permutation operation tt • x\ applies to all atoms in x\. To avoid this we introduce an 
auxiliary permutation operations, written _ •£„ _, for deep binders that only permutes bound atoms 
(or more precisely the atoms specified by the Zw-functions) and leaves the other atoms unchanged. 
Like the functions faJbn\^ m , we can define these permutation operations over raw terms analysing 
how the functions bn\_, m are defined. Assuming the user specified a clause 

bn[C x\ ... x r ) = rhs 

def 

we define it (C jci . . . x r ) = Cy\ ... y T with yi determined as follows: 

• yi = Xi provided Xi does not occur in rhs 

• yi = tt Xi provided bn Xi is in rhs 

• yi = tt • Xi otherwise 

Using again the quotient package we can lift the auxiliary permutation operations _ _ to alpha- 
equated terms. Moreover we can prove the following two properties: 

Lemma 7.1. Given a binding function bn a and auxiliary equivalence then for all tt 

(i) tt • (bn a x) = bn a (tt '% n x) and 

(ii) (tt -% n x) &% n x. 

Proof. By induction on x. The properties follow by unfolding of the definitions. □ 

The first property states that a permutation applied to a binding function is equivalent to first per- 
muting the binders and then calculating the bound atoms. The second states that _ -% n _ preserves 
«$ n . The main point of the auxiliary permutation functions is that they allow us to rename just the 
bound atoms in a term, without changing anything else. 

Having the auxiliary permutation function in place, we can now solve all remaining cases. For 
the Let a term-constructor, for example, we can by Property |2.5 l ob tain a tt such that 

(tt • (set (bn a xi)) #* c tt • [bn a Xi]n S f *2 = [bn a xi][ ist . X2 

hold. Using the first part of Lemma 17711 we can simplify this to set (bn a (tt •%„ x\)) #* c and 
[bn a (tt <% n Xi)]n st . i 71 '^) = [bn a Xi]u st . X2- Since (it >% n x\) xi% n x\ holds by the second part, we 
can infer that 
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Let a (tt x\) (ir >X2) = Let a x\ X2 

holds. This allows us to use the implication from the strong cases lemma, and we are done. 

Consequently, we can discharge all proof-obligations about having 'covered all cases'. This 
completes the proof establishing that the weak induction principles imply the strong induction prin- 
ciples. These strong induction principles have already proved being very useful in practice, partic- 
ularly for proving properties about capture-avoiding substitution ll26l . 

8. Related Work 

To our knowledge the earliest usage of general binders in a theorem prover is described by Nara- 
schewski and Nipkow [ 15 ] with a formalisation of the algorithm W. This formalisation implements 
binding in type-schemes using a de-Bruijn indices representation. Since type-schemes in W contain 
only a single place where variables are bound, different indices do not refer to different binders 
(as in the usual de-Bruijn representation), but to different bound variables. A similar idea has 
been recently explored for general binders by Chargueraud Q in the locally nameless approach 
to binding. There, de-Bruijn indices consist of two numbers, one referring to the place where a 
variable is bound, and the other to which variable is bound. The reasoning infrastructure for both 
representations of bindings comes for free in theorem provers like Isabelle/HOL and Coq, since the 
corresponding term-calculi can be implemented as 'normal' datatypes. However, in both approaches 
it seems difficult to achieve our fine-grained control over the 'semantics' of bindings (i.e. whether 
the order of binders should matter, or vacuous binders should be taken into account). To do so, one 
would require additional predicates that filter out unwanted terms. Our guess is that such predicates 
result in rather intricate formal reasoning. We are not aware of any formalisation of a non-trivial 
language that uses Chargueraud's idea. 

Another technique for representing binding is higher-order abstract syntax (HOAS), which for 
example is implemented in the Twelf system lfl6l . This representation technique supports very 
elegantly many aspects of single binding, and impressive work by Lee et al fill has been done 
that uses HOAS for mechanising the metatheory of SML. We are, however, not aware how multiple 
binders of SML are represented in this work. Judging from the submitted Twelf-solution for the 
POPLmark challenge, HOAS cannot easily deal with binding constructs where the number of bound 
variables is not fixed. For example, in the second part of this challenge, Lets involve patterns that 
bind multiple variables at once. In such situations, HOAS seems to have to resort to the iterated- 
single-binders-approach with all the unwanted consequences when reasoning about the resulting 
terms. 

Two formalisations involving general binders have been performed in older versions of Nomi- 
nal Isabelle (one about Psi-calculi and one about algorithm W [ 3] |29j). Both use the approach based 
on iterated single binders. Our experience with the latter formalisation has been disappointing. 
The major pain arose from the need to 'unbind' bound variables and the resulting formal reasoning 
turned out to be rather unpleasant. In contrast, the unbinding can be done in one step with our 
general binders described in this paper. 

The most closely related work to the one presented here is the Ott-tool by Sewell et al |[22l 
and the Caml language by Pottier lfl9l . Ott is a nifty front-end for creating LTjjX documents from 
specifications of term-calculi involving general binders. For a subset of the specifications Ott can 
also generate theorem prover code using a 'raw' representation of terms, and in Coq also a locally 
nameless representation. The developers of this tool have also put forward (on paper) a definition 
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for alpha-equivalence and free variables for terms that can be specified in Ott. This definition is 
rather different from ours, not using any nominal techniques. To our knowledge there is no concrete 
mathematical result concerning this notion of alpha-equivalence and free variables. We have proved 
that our definitions lead to alpha-equated terms, whose support is as expected (that means bound 
atoms are removed from the support). We also showed that our specifications lift from 'raw' terms to 
alpha-equivalence classes. For this we have established (automatically) that every term-constructor 
and function defined for 'raw' terms is respectful w.r.t. alpha-equivalence. 

Although we were heavily inspired by the syntax of Ott, its definition of alpha-equivalence 
is unsuitable for our extension of Nominal Isabelle. First, it is far too complicated to be a basis 
for automated proofs implemented on the ML-level of Isabelle/HOL. Second, it covers cases of 
binders depending on other binders, which just do not make sense for our alpha-equated terms (the 
corresponding /a-functions would not lift). Third, it allows empty types that have no meaning in 
a HOL-based theorem prover. We also had to generalise slightly Ott's binding clauses. In Ott one 
specifies binding clauses with a single body; we allow more than one. We have to do this, because 
this makes a difference for our notion of alpha-equivalence in case of binds (set) and binds (set+). 
Consider the examples 

Foo\ xswname fset t:\trm s:\trm binds (set) xs in t s 

F002 xsv.name fset t::trm s:\trm binds (set) xs in t, binds (set) xs in s 

In the first term-constructor we have a single body that happens to be 'spread' over two arguments; 
in the second term-constructor we have two independent bodies in which the same variables are 
bound. As a result we have@ 

Foo\ {a, b} (a, b) (a, b) 7^ Foo\ {a, b} (a, b) (b, a) 

but 

F002 {a, b} (a, b) (a, b) = F002 {a, b} (a, b) (b, a) 

and therefore need the extra generality to be able to distinguish between both specifications. Because 
of how we set up our definitions, we also had to impose some restrictions (like a single binding 
function for a deep binder) that are not present in Ott. Our expectation is that we can still cover 
many interesting term-calculi from programming language research, for example the Core-Haskell 
language from the Introduction. With the work presented in this paper we can define it formally 
as shown in Figure [2] and then Nominal Isabelle derives automatically a corresponding reasoning 
infrastructure. However we have found out that telescopes seem to not easily be representable in 
our framework. The reason is that we need to be able to lift our ^-functions to alpha-equated 
lambda-terms and therefore need to restrict what these ft«-functions can return. Telescopes can be 
represented in the framework described in lETI using an extension of the usual locally-nameless 
representation. 

Pottier presents a programming language, called Caml, for representing terms with general 
binders inside OCaml |fl9l . This language is implemented as a front-end that can be translated to 
OCaml with the help of a library. He presents a type-system in which the scope of general binders 
can be specified using special markers, written inner and outer. It seems our and his specifications 



Assuming a 7^ b, there is no permutation that can make (a, b) equal with both (a, b) and (b, a), but there are two 
permutations so that we can make (a, b) and (a, b) equal with one permutation, and (a, b) and (b, a) with the other. 
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atom_decl var cvar tvar 

nominal-datatype tkind = KStar \ KFun tkind tkind 

and ckind = CKSim ty ty 

and ty = TVar tvar \ T string \ TApp ty ty 

| TFun string tyJtist \ TAll tvwtvar tkind tyr.ty binds tv in ty 

TArr ckind ty 
and tyJist = TNil \ TCons ty tyJtst 

and cty = CVar cvar \ C string \ CApp cty cty \ CFun string coJtst 

| CAR cvv.cvar ckind ctyv.cty binds cv in cty 

| CArr ckind cty \ CRefl ty \ CSym cty \ CCirc cty cty 

| CAt cty ty \ CLeft cty \ CRight cty \ CSim cty cty 

| CRightc cty \ CLeftc cty \ Coerce cty cty 

and coJLst = CNil \ CCons cty coJLst 

and trm = Var var \ K string 

LAMjty tv.-.tvar tkind t:\trm binds tv in t 

LAM_cty cv.-.cvar ckind t:\trm binds cv in t 

App_ty trm ty \ App_cty trm cty \ App trm trm 

Lam vv.var ty t:\trm binds v in t 
| Let x:\var ty trm t:\trm binds x in t 

Case trm assoc_lst \ Cast trm co 
and assocJLst — ANil \ ACons pv.pat t:\trm assocAst binds bv pint 
and pat = Kpat string tvtkJtst tvck_lst vtJLst 
and vt_lst = VTNil \ VTCons var ty vt_lst 
and tvtkJst = TVTKNil \ TVTKCons tvar tkind tvtkJst 
and tvckJist — TVCKNil \ TVCKCons cvar ckind tvck_lst 
binder 

bv :: pat atom list and 
bv\ :: vt—lst => atom list and 
bvi :: tvtk_lst => atom list and 
bv-j, :: tvck_lst => atom list 
where 

bv (K s tvts tvcs vs) = (bv3 tvts) @ (bv2 tvcs) @ (bv\ vs) 
| bvi VTNil = [] 

| bv\ (VTCons x ty tl) = (atom x)::(bv± tl) 
bv 2 TVTKNil = [] 

bv2 (TVTKCons a ty tl) = (atom a)::(bv2 tl) 
bv 3 TVCKNil = [] 
| bv3 (TVCKCons c cty tl) — (atom c)::(bv3 tl) 



Figure 2: A definition for Core-Haskell in Nominal Isabelle. For the moment we do not support 
nested types; therefore we explicitly have to unfold the lists coJtst, assocJlst and so on. 
Apart from that limitation, the definition follows closely the original shown in Figure Q] 
The point of our work is that having made such a definition in Nominal Isabelle, one 
obtains automatically a reasoning infrastructure for Core-Haskell. 
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can be inter-translated as long as ours use the binding mode binds only. However, we have not 
proved this. Pottier gives a definition for alpha-equivalence, which also uses a permutation operation 
(like ours). Still, this definition is rather different from ours and he only proves that it defines 
an equivalence relation. A complete reasoning infrastructure is well beyond the puiposes of his 
language. Similar work for Haskell with similar results was reported by Cheney [6] and more 
recently by Weirich et al ||3TI . 

In a slightly different domain (programming with dependent types), Altenkirch et al [ 1 1 present 
a calculus with a notion of alpha-equivalence related to our binding mode binds (set+). Their 
definition is similar to the one by Pottier, except that it has a more operational flavour and calculates 
a partial (renaming) map. In this way, the definition can deal with vacuous binders. However, to our 
best knowledge, no concrete mathematical result concerning this definition of alpha-equivalence has 
been proved. 

9. Conclusion 

We have presented an extension of Nominal Isabelle for dealing with general binders, that is where 
term-constructors have multiple bound atoms. For this extension we introduced new definitions of 
alpha-equivalence and automated all necessary proofs in Isabelle/HOL. To specify general binders 
we used the syntax from Ott, but extended it in some places and restricted it in others so that the 
definitions make sense in the context of alpha-equated terms. We also introduced two binding modes 
(set and set+) that do not exist in Ott. We have tried out the extension with calculi such as Core- 
Haskell, type-schemes and approximately a dozen of other typical examples from programming 
language research [21]. The code will eventually become part of the Isabelle distribution^ 

We have left out a discussion about how functions can be defined over alpha-equated terms 
involving general binders. In earlier versions of Nominal Isabelle this turned out to be a thorny 
issue. We hope to do better this time by using the function package [11] that has recently been 
implemented in Isabelle/HOL and also by restricting function definitions to equivariant functions 
(for them we can provide more automation). 

There are some restrictions we had to impose in this paper that can be lifted using a recent 
reimplementation [25 ] of the datatype package for Isabelle/HOL, which however is not yet part of 
the stable distribution. This reimplementation allows nested datatype definitions and would allow 
one to specify, for instance, the function kinds in Core-Haskell as TFun string (ty list) instead of 
the unfolded version TFun string ty-list (see Figure |2}. We can also use it to represent the Let- 
terms from the Introduction where the order of /e?-assignments does not matter. This means we can 
represent Lets such that the following two terms are equal 

Let x\ = t\ and %2 = ?2 in s = Let x<i = t2 and x\ = t\ in s 

For this we have to represent the Lef-assignments as finite sets of pair and a binding function that 
picks out the left components to be bound in s. 

One line of future investigation is whether we can go beyond the simple-minded form of binding 
functions that we adopted from Ott. At the moment, binding functions can only return the empty 
set, a singleton atom set or unions of atom sets (similarly for lists). It remains to be seen whether 
properties like 



It can be downloaded already from http://isabelle.in.tum.de/nominal/download 
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fa_ty x = bn x U faJbn x 

allow us to support more interesting binding functions. 

We have also not yet played with other binding modes. For example we can imagine that there 
is need for a binding mode where instead of usual lists, we abstract lists of distinct elements (the 
corresponding type dlist already exists in the library of Isabelle/HOL). We expect the presented 
work can be extended to accommodate such binding modes. 
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